需要时拿起DNSSEC
Take up DNSSEC When Needed
摘要：
缓存中毒攻击的威胁在很大程度上刺激了DNSSEC的部署。作为一种强大但要求苛刻的密码防御，DNSSEC的普遍采用预计将经历一个漫长的过渡。因此，DNSSEC从业者呼吁一个安全而轻量级的解决方案，以加快DNSSEC部署，同时提供可接受的DNSSEC般的防御。本文提出了一种新的防御缓存中毒攻击，仍然使用，但轻微使用DNSSEC。在该解决方案中，DNS在DNSSEC不经意模式下运行，除非检测到潜在的攻击并触发切换到DNSSEC感知模式。分析和验证了该防御的性能。模型检验结果表明，只需要很小的DNSSEC查询负载，以确保足够小的缓存中毒成功率。
英文摘要：
The threats of caching poisoning attacks largely stimulate the deployment of DNSSEC. Being a strong but demanding cryptographical defense, DNSSEC has its universal adoption predicted to go through a lengthy transition. Thus the DNSSEC practitioners call for a secure yet lightweight solution to speed up DNSSEC deployment while offering an acceptable DNSSEC-like defense. This paper proposes a new defense against cache poisoning attacks, still using but lightly using DNSSEC. In the solution, DNS operates in the DNSSEC-oblivious mode unless a potential attack is detected and triggers a switch to the DNSSEC-aware mode. The performance of the defense is analyzed and validated. The modeling checking results demonstrate that only a small DNSSEC query load is needed to ensure a small enough cache poisoning success rate.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
